2,672 documents not provided to the National Assembly, downloaded without separate authentication
Including company information and personal contact information... Poor management of government data
(Seoul = Yonhap News) Reporter Park Sang-hyun = Amid a series of hacking and information leakage incidents in the domestic financial sector, public institutions, and universities, it has been pointed out that there are security loopholes in the Ministry of Food and Drug Safety's management of clinical trial data.
The government's information security management system was put on the chopping block after a government audit revealed that 2,672 clinical trial documents that had been managed privately by the Ministry of Food and Drug Safety could be downloaded using generative artificial intelligence (AI) ChatGPT without a separate login or password entry.
◇ Download 2,672 clinical trial documents with ChatGPT
People Power Party lawmaker Lee So-hee revealed at the National Assembly Health and Welfare Committee audit held on the 13th that she downloaded 2,672 clinical trial result documents that the Ministry of Food and Drug Safety had not provided to the National Assembly without logging in or entering a password using ChatGPT alone.
Representative Lee said that it was possible to download without advanced knowledge, and that 839 of the documents contained company information that was set to be private, and 2,208 contained the mobile phone number of the person in charge.
The website where Rep. Lee checked the clinical trial results using ChatGPT is ‘Drug Safety Country’, which contains information on various drugs.
This website includes information on pharmacogenetics, pharmaceuticals and cosmetics, domestic and foreign pharmaceutical patents, biopharmaceuticals, and pharmaceutical additives, as well as clinical trial information.
As Representative Lee pointed out, if it were possible to download private data containing personal information using only ChatGPT, there is a possibility that some important information may have been exposed in advance.
Rep. Lee said, “They locked the door in the National Assembly, saying it was a corporate secret, but they actually allowed the file to be taken from outside,” and requested that the Ministry of Food and Drug Safety destroy the downloaded data.
The key point of this criticism is that the clinical trial results document that the Ministry of Food and Drug Safety did not provide to the National Assembly was downloaded from outside without a separate login or password entry.
However, it has not been specifically confirmed how ChatGPT accessed the document or what problems there were in access control of 'Drug Safety Nation'.
◇ Following the financial sector, the Ministry of Food and Drug Safety is also controversial about information security loopholes.
The recent hacking incident that occurred in Korea has spread beyond the financial sector to public companies, universities, and large churches.
The leaked information is diverse, including credit information of bank loan customers, contact information of public enterprise employees, school records of university members, and lists of church members. Clinical trial results are considered to be very important as they contain corporate secrets.
However, this Ministry of Food and Drug Safety case is different in that it is not an information leak due to external hacking, but rather an indication that private documents were accessed without a separate authentication process. It has not been confirmed whether a third party actually viewed or downloaded the data.
An official in the IT industry said, "If it is important information, it should be possible to download it only if it goes through a separate authentication process. If anyone can search and view the Ministry of Food and Drug Safety's internal data, the information may have been leaked."
He added, “If the Ministry of Food and Drug Safety is to the point of mentioning disposal, it may contain sensitive content,” and added, “With this National Assembly audit, it will be impossible to avoid criticism that there are loopholes in government security management.”
